feat: online verification, node removals, and knowledge browser

Adds claim-bound online evidence records and citation verification scripts,
node removal transport/adapter, retrieval benchmark and owner-review tooling,
GraphCanvas/SourceDetail knowledge browser UI, and the ingest handoff helper.
Bumps the agents/gewu pack to the online-verification branch.

docs/acceptance/2026-10-16-knowledge-browser.md

@@ -0,0 +1,30 @@
+# Knowledge browser implementation acceptance
+
+Date: 16 October 2026  
+Status: implementation delivered; local automated verification passed; product-level and visual acceptance remain partial.
+
+## Delivered
+
+- Added authenticated `POST /v1/knowledge/browse` with empty-query browsing, project/shared scope, deterministic filters and ordering, project and filtered counts, project-wide facet vocabulary/counts, bounded pages and revision-bound cursors.
+- Added authenticated `POST /v1/knowledge/graph` with authorized center-node one-hop neighborhoods; both browse routes are HTTP-only in the operation catalog. The source list returns its authorized total. Regenerated OpenAPI, catalog and TypeScript contracts and refreshed the agent pack manifest.
+- Replaced the stale/problems/topics side links with project Knowledge, Sources and Graph tabs. The knowledge list has title/date/relevance sorting, immediate type/freshness/shared filters, searchable multi-select tag/audience/use/domain facets, count labels, a cursor-backed Previous/Next pager, URL-restorable page number, and restart behavior for expired cursors. Sources has an accurate count/range and Previous/Next controls.
+- Kept the evidence reader and added navigable incoming/outgoing relationship targets, source-target opening and neighbor pagination. The graph has scope selection, search/type filters, grouping, zoom/reset, prominent accepted edges, faint links for nodes citing the same source revision, a compact node preview with reader navigation, and a synchronized accessible node list.
+
+## Verification
+
+- `./.venv/bin/python -m pytest -q`: **209 passed**.
+- `npm --prefix web run build`: passed (TypeScript and production Vite build).
+- `npm --prefix web test -- src/shell/App.test.tsx`: **16 passed**.
+- `npm --prefix web run check`: TypeScript and ESLint passed; **6 unrelated existing failures** remain in Accounts, Admin and ProjectsSection tests.
+- `./.venv/bin/python agents/gewu/scripts/manifest_tool.py verify`: passed.
+- Restarted the local API on port 8000 and Vite on port 5173; `/health` returned `{"status":"ok","service":"gewu"}` and the app HTML loaded. T3 navigation reached the restarted UI at 1280×800, but snapshot automation failed, so no screenshot or signed-in project interaction is claimed.
+
+## Remaining acceptance work
+
+- Filters disclose searchable native checkbox groups with removable selected chips and counts; a dedicated keyboard/screen-reader usability and type-ahead review remains open.
+- Knowledge page number reload and browser navigation rebuild the opaque cursor stack. Source page navigation has counts and Previous/Next but its current page does not yet restore after reload.
+- Graph selection and Fit to selection load a scoped one-hop neighborhood; viewport/layout restoration after opening a node is not implemented. Graph controls and node list have not been checked at narrow widths.
+- Automated tests cover URL page-two restoration, source page navigation, a scoped neighborhood and denied center-node access. Synthetic tests do not establish pagination against a >40-node corpus with duplicate titles, nor graph behavior under a large capped fixture. Denied-edge browser flows, full focus restoration, and narrow-width/assistive-technology review remain open.
+- Source totals are counted through the index separately from source rows, so cross-index atomic freshness is not guaranteed.
+- The full web check still has six failures in Accounts, Admin and ProjectsSection tests unrelated to this feature. TypeScript and ESLint pass before those test failures.
+